@oxyhq/core 21.0.2 → 21.1.0

package/dist/esm/mixins/OxyServices.utility.js

@@ -81,7 +81,26 @@ export function OxyServicesUtilityMixin(Base) {
                 return cached.result;
             }
             try {
-                const result = await this.makeRequest('GET', '/internal/service-acting-as/verify', { appId, userId }, { cache: false, retry: false, timeout: 5000 });
+                // The verify endpoint is service-to-service and admits only a
+                // platform-TRUSTED calling application, so this call must carry the
+                // VERIFIER's own service token. Sent explicitly rather than through
+                // `makeServiceRequest`, which would drop `retry: false` and the timeout
+                // — and those two are not incidental: this runs inside request-handling
+                // middleware, so an inner retry loop multiplies the latency of every
+                // delegated request by the number of attempts.
+                //
+                // A verifier with no service credentials configured throws here and
+                // lands in the catch below, which is the correct outcome. A host that
+                // cannot prove who it is has no business being told which users have
+                // delegated to which applications, and the 60s negative cache stops a
+                // misconfigured deployment from turning every request into a round trip.
+                const serviceToken = await this.getServiceToken();
+                const result = await this.makeRequest('GET', '/internal/service-acting-as/verify', { appId, userId }, {
+                    cache: false,
+                    retry: false,
+                    timeout: 5000,
+                    headers: { Authorization: `Bearer ${serviceToken}` },
+                });
                 const authorized = Boolean(result && result.authorized);
                 const verified = authorized
                     ? { authorized: true, scopes: Array.isArray(result.scopes) ? result.scopes : [] }
@@ -778,6 +797,20 @@ export function OxyServicesUtilityMixin(Base) {
          * service requests require the app scope. Delegated user requests require
          * BOTH the app scope and the per-user delegation scope.
          *
+         * The intersection is the point, not a redundancy, because the two scope
+         * lists answer different questions and neither implies the other:
+         *
+         *   `serviceApp.scopes`      what the PLATFORM allows this application to do
+         *                            (credential ∩ application ceiling, at mint time)
+         *   `serviceActingAs.scopes` what THIS USER allowed it to do (`app_grants`)
+         *
+         * Requiring only the app scope would let an application do to a user
+         * something that user never consented to; requiring only the grant would let
+         * a user hand an application authority staff never gave it, so a revoked
+         * platform scope would keep working for every user who had already
+         * consented. Effective authority is the intersection, and this is where it
+         * is taken.
+         *
          * Requests authenticated as a regular user (no service token) are rejected
          * with 403 — scope-protected endpoints are service-to-service by design.
          *

package/dist/esm/server/index.js

@@ -22,7 +22,13 @@ export { assertSafePublicUrl, isBlockedIp, safeFetch, SsrfRejection, UpstreamErr
 export { createOxyCors } from './cors.js';
 // Shared Helmet + Content-Security-Policy baseline (Cloudflare Insights beacon,
 // Oxy API/CDN origins) with additive, per-app extensions.
-export { buildOxyCspDirectives, buildOxyPagesHeaders, createOxySecurityHeaders, formatOxyCspPolicy, OXY_CSP_BASELINE, } from './securityHeaders.js';
+//
+// `extractInlineScripts` / `inlineScriptCspHash` / `cspSourcesFor` are exported
+// so a post-deploy gate can ask the SERVED document and the SERVED policy the
+// same questions `buildOxyPagesHeaders` asked the built ones. A gate that
+// re-implemented the scan or the parse would be testing its own copy, and would
+// agree with a broken original.
+export { buildOxyCspDirectives, buildOxyPagesHeaders, createOxySecurityHeaders, cspSourcesFor, extractInlineScripts, formatOxyCspPolicy, inlineScriptCspHash, OXY_CSP_BASELINE, } from './securityHeaders.js';
 // Constant-time secret comparison.
 export { verifySecret } from './verifySecret.js';
 // Cross-service user-invalidation signal: oxy-api publishes when identity

package/dist/esm/server/securityHeaders.js

@@ -33,6 +33,19 @@
  *     cannot pass their own `contentSecurityPolicy` through to Helmet at all
  *     (the option is typed `never`).
  *
+ *  3. A STATIC EXPO EXPORT SHIPS AN INLINE SCRIPT THE BASELINE FORBIDS.
+ *     `web.output: 'static'` makes Expo Router emit
+ *     `<script type="module">globalThis.__EXPO_ROUTER_HYDRATE__=true;</script>`,
+ *     which is what tells the client entry to call `hydrateRoot` instead of
+ *     `createRoot().render()`. Nothing in app code puts it there, so — like the
+ *     Cloudflare beacon above — an app cannot allowlist it from the app side.
+ *     Measured on `accounts.oxy.so` 2026-08-21: blocked, so every visit threw
+ *     away the server-rendered markup and re-rendered from scratch, with only a
+ *     console error to show for it. The hashes are therefore DERIVED from the
+ *     built output rather than hand-written (see {@link extractInlineScripts}):
+ *     a hash pasted into config is correct exactly until the build changes one
+ *     byte, and then it fails the same silent way.
+ *
  * WHAT IT PROVIDES
  * ----------------
  * `createOxySecurityHeaders(options)` returns the Helmet middleware with the
@@ -53,6 +66,7 @@
  *
  * Node/Express-only: exported solely from `@oxyhq/core/server`.
  */
+import { createHash } from 'node:crypto';
 import helmet from 'helmet';
 /** CSP keyword for "this origin". Always present in every open baseline directive. */
 const SELF = "'self'";
@@ -176,13 +190,139 @@ export function formatOxyCspPolicy(directives) {
         .map(([name, sources]) => (sources.length === 0 ? name : `${name} ${sources.join(' ')}`))
         .join('; ');
 }
+/**
+ * The source list one directive carries in a serialized policy, or `[]` when
+ * the policy does not name that directive. The inverse of
+ * {@link formatOxyCspPolicy}, and the reason it lives here rather than beside
+ * either caller: the post-deploy gate parses the policy the ORIGIN serves while
+ * the unit test parses the one the middleware renders, so a copy in each would
+ * let the header shape change with the test still green and the gate reading
+ * `[]` — reporting every script blocked, which reads as a broken app rather
+ * than as a broken parser.
+ *
+ * A directive present with no sources (`upgrade-insecure-requests`) and a
+ * directive absent entirely both answer `[]`. Callers that need to tell those
+ * apart are asking a different question than "what is allowed here".
+ */
+export function cspSourcesFor(policy, directive) {
+    const segment = policy
+        .split(';')
+        .map((entry) => entry.trim())
+        .find((entry) => entry === directive || entry.startsWith(`${directive} `));
+    return segment === undefined ? [] : segment.split(/\s+/).slice(1);
+}
+/**
+ * Index of the `>` that closes a tag whose attribute region starts at `from`,
+ * or `-1` if the document ends first. Quote-aware: a `>` inside an attribute
+ * VALUE does not close the tag.
+ *
+ * No HTML any Oxy build currently emits contains such an attribute, so this is
+ * not load-bearing today — it is here because the same scanner reads the SERVED
+ * document in the post-deploy gate, and what an edge injects into that document
+ * is not ours to constrain. Getting it wrong is not a parse error: the body
+ * window shifts, the hash is computed over the wrong bytes, and the script is
+ * blocked exactly as if no hash had been derived at all.
+ */
+function findTagEnd(html, from) {
+    let quote = null;
+    for (let index = from; index < html.length; index += 1) {
+        const character = html[index];
+        if (quote !== null) {
+            if (character === quote)
+                quote = null;
+            continue;
+        }
+        if (character === '"' || character === "'") {
+            quote = character;
+            continue;
+        }
+        if (character === '>')
+            return index;
+    }
+    return -1;
+}
+/**
+ * Every inline `<script>` body in an HTML document, in document order. A
+ * `<script src=…>` is a URL the source list already governs and is skipped.
+ *
+ * Scanned rather than matched with one regex because the two failure modes are
+ * not symmetric: an EXTRA body costs a redundant hash nobody notices, while a
+ * MISSED body silently reinstates the exact breakage this exists to prevent.
+ * So the scan errs toward finding them — it walks the open tag quote-aware
+ * instead of letting a `>` inside an attribute value truncate it.
+ *
+ * The type attribute is deliberately not consulted. Whether a given `type`
+ * executes is a browser decision (and it changes: `importmap` and
+ * `speculationrules` were both once inert), and pinning the exact bytes of a
+ * data block we ship ourselves weakens nothing.
+ */
+export function extractInlineScripts(html) {
+    const lowered = html.toLowerCase();
+    const bodies = [];
+    const openTag = /<script\b/gi;
+    let match = openTag.exec(html);
+    while (match !== null) {
+        const attributesStart = match.index + match[0].length;
+        const attributesEnd = findTagEnd(html, attributesStart);
+        if (attributesEnd < 0)
+            break;
+        const bodyStart = attributesEnd + 1;
+        const bodyEnd = lowered.indexOf('</script', bodyStart);
+        if (bodyEnd < 0)
+            break;
+        if (!/\bsrc\s*=/i.test(html.slice(attributesStart, attributesEnd))) {
+            bodies.push(html.slice(bodyStart, bodyEnd));
+        }
+        openTag.lastIndex = bodyEnd;
+        match = openTag.exec(html);
+    }
+    return bodies;
+}
+/**
+ * The `'sha256-…'` source that allows one inline script, hashed over its exact
+ * bytes as CSP specifies — no trimming, no normalization. One byte of
+ * whitespace either way is a different hash and the script stays blocked.
+ */
+export function inlineScriptCspHash(source) {
+    return `'sha256-${createHash('sha256').update(source, 'utf8').digest('base64')}'`;
+}
+/**
+ * Ceiling on how many derived inline-script hashes may enter one `_headers`
+ * block. Nothing in an Oxy app authors an inline script, so the realistic
+ * count is the ONE Expo Router hydration flag — deduped across every route's
+ * HTML, because it is byte-identical in all of them.
+ *
+ * The ceiling exists because one future change breaks that: a route loader
+ * makes Expo emit a SECOND inline script, `__EXPO_ROUTER_LOADER_DATA__`, whose
+ * bytes differ per route. The hashes stay CORRECT (they are derived from the
+ * same build that ships), but the count becomes the route count and the policy
+ * grows without bound on every response. That is a decision to take
+ * deliberately, so it arrives as a red build rather than a quietly enormous
+ * header.
+ */
+const MAX_INLINE_SCRIPT_HASHES = 8;
 /**
  * Build a Cloudflare Pages `_headers` block for an Oxy HTML origin. Uses the
  * same CSP resolution as {@link createOxySecurityHeaders} plus the non-CSP
  * hardening headers Helmet would add on an Express HTML backend.
+ *
+ * Adding a hash to `script-src` does not narrow it: per CSP Level 3 a hash is
+ * an additional source, so `'self'` and the beacon host keep matching external
+ * scripts. (It WOULD neutralize `'unsafe-inline'` in the same directive — which
+ * is why this hashes scripts only. `style-src` keeps `'unsafe-inline'` for
+ * react-native-web's runtime stylesheet, and a style hash would silently switch
+ * that off and render every Oxy web app unstyled.)
  */
 export function buildOxyPagesHeaders(options = {}) {
-    const csp = formatOxyCspPolicy(buildOxyCspDirectives(options.csp));
+    const hashes = [
+        ...new Set((options.html ?? []).flatMap(extractInlineScripts).map(inlineScriptCspHash)),
+    ];
+    if (hashes.length > MAX_INLINE_SCRIPT_HASHES) {
+        throw new RangeError(`Oxy CSP: ${hashes.length} distinct inline scripts in the built HTML exceeds the ${MAX_INLINE_SCRIPT_HASHES}-hash ceiling. A per-route inline data block (e.g. an Expo Router loader) is the likely cause; allow it deliberately rather than by raising this.`);
+    }
+    const csp = formatOxyCspPolicy(buildOxyCspDirectives(hashes.length === 0
+        ? options.csp
+        : { ...options.csp, scriptSrc: [...(options.csp?.scriptSrc ?? []), ...hashes] }));
     const lines = [
         '/*',
         `  Content-Security-Policy: ${csp}`,